CVE-2026-64324

In the Linux kernel, the following vulnerability has been resolved:

udf: validate free block extents against the partition length

udf_free_blocks() checks the logical block number and count against the

partition length, but drops the extent offset from that final bound. A

crafted extent can pass the guard while logicalBlockNum + offset + count

points past the partition, which later indexes past the space bitmap

array.

A single ftruncate(2) on a file backed by such an extent reliably

panics the kernel. This is a local availability issue. On desktop

systems where UDisks/polkit allows the active user to mount removable

UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply

the crafted filesystem and trigger the panic by truncating a writable

file on it. Systems that require root or CAP_SYS_ADMIN to mount the

image have a higher prerequisite.

No confidentiality or integrity impact is claimed: the reproduced

primitive is an out-of-bounds read of a bitmap pointer slot followed by

a kernel panic.

Use the already computed logicalBlockNum + offset + count value for the

partition length check. Also make load_block_bitmap() reject an

out-of-range block group before indexing s_block_bitmap[], so corrupted

callers cannot walk past the flexible array.